Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,598 results · page 32 of 32

Sep 27, 2017Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14847 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14846 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14845 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.CVE-2017-14844 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14843 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recuCVE-2017-14760 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recurrence_id parameter to /wp-admin/admin.php.
Product
event-espresso-free (aka Event Espresso Lite)
Affected
up to 3.1.37.12.l
What to do
Affects up to 3.1.37.12.l. Update event-espresso-free (aka Event Espresso Lite) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record sstrunk.com sstrunk.com
Sep 20, 2017WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.CVE-2015-2826 · WordPress plugins & themes · reported by MITREMedium 5.3
WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Sep 17, 2017WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstraCVE-2017-14530 · WordPress plugins & themes · reported by MITREHigh 8
WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences.
Product
WP_Admin_UI in the Crony Cronjob Manager
Fixed in
0.4.7
What to do
Update WP_Admin_UI in the Crony Cronjob Manager to 0.4.7 or newer.
Full record and what to do →NVD record cybersecurityworks.com github.com
Sep 14, 2017Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/CVE-2017-1002023 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php
Affected
1.3.2 to 1.3.2
What to do
Affects 1.3.2 to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Sep 12, 2017In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via CVE-2015-9229 · WordPress plugins & themes · reported by MITREMedium 4.8
In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images[1][alttext] parameter.
Product
Photocrati NextGEN Gallery
Affected
2.1.15 to 2.1.15
What to do
Affects 2.1.15 to 2.1.15. Update Photocrati NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cybersecurityworks.com github.com
Aug 7, 2017The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.CVE-2014-9260 · WordPress plugins & themes · reported by MITREHigh 8.8
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.
Product
basic_settings function in the download manager
Fixed in
2.7.3
What to do
Update basic_settings function in the download manager to 2.7.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 7, 2017WordPress Download Manager prior to version 2.9.51: Open redirectCVE-2017-2217 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Product
WordPress Download Manager prior to version 2.9.51
Affected
up to 2.9.50
What to do
Affects up to 2.9.50. Update WordPress Download Manager prior to version 2.9.51 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jul 7, 2017WordPress Download Manager prior to version 2.9.50: Cross-site scriptingCVE-2017-2216 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WordPress Download Manager prior to version 2.9.50
Affected
up to 2.9.49
What to do
Affects up to 2.9.49. Update WordPress Download Manager prior to version 2.9.50 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Mar 16, 2017Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remotCVE-2016-0770 · WordPress plugins & themes · reported by Red HatMedium 6.1
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s variable.
Product
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory
Fixed in
8.5.9
What to do
Update Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory to 8.5.9 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Aug 13, 2015Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTCVE-2015-2321 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email field.
Product
Job Manager
Affected
up to 0.7.22
What to do
Affects up to 0.7.22. Update Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Apr 21, 2015Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote attackers to execute arbCVE-2015-2825 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the path parameter.
Product
Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager
Fixed in
2.5.96
What to do
Update Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager to 2.5.96 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Apr 6, 2015Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitrary SQL commands viaCVE-2015-2824 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitrary SQL commands via a (1) hits[][] parameter in a sam_hits action to sam-ajax.php; the (2) cstr parameter in a load_posts action to sam-ajax-admin.php; the (3) searchTerm parameter in a load_combo_data action to sam-ajax-admin.php; or the (4) subscriber, (5) contributor, (6) author, (7) editor, (8) admin, or (9) sadmin parameter in a load_users action to sam-ajax-admin.php.
Product
Multiple SQL injection vulnerabilities in the Simple Ads Manager
Fixed in
2.7.97
What to do
Update Multiple SQL injection vulnerabilities in the Simple Ads Manager to 2.7.97 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 5, 2014The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remCVE-2014-8877 · WordPress plugins & themes · reported by MITREHigh 10
The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP create_function function.
Product
alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager
Fixed in
2.0.4
What to do
Update alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager to 2.0.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com itas.vn
Dec 5, 2014Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack thCVE-2014-9129 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the addons_title parameter in the CMDM_admin_settings page to wp-admin/admin.php.
Product
Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager
Fixed in
2.0.7
What to do
Update Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager to 2.0.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Dec 2, 2014Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 aCVE-2014-9178 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter in the email_vendor function or id parameter in the (2) download_project, (3) download_archive, or (4) remove_cat function.
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 2, 2014Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites andCVE-2014-8754 · WordPress plugins & themes · reported by MITREMedium 5.8
Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the out parameter.
Product
Ad-Manager
Affected
1.1.2 to 1.1.2
What to do
Affects 1.1.2 to 1.1.2. Update Ad-Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 4, 2014the WordPress Download Manager plugin for: Directory traversalCVE-2014-8585 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the fname parameter to (1) views/file_download.php or (2) file_download.php.
Product
the WordPress Download Manager plugin for
What to do
Update the WordPress Download Manager plugin for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 31, 2014The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacteCVE-2014-8334 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backup['filepath'] (aka "Path to Backup:" field) or (2) $backup['mysqldumppath'] variable.
Product
WP-DBManager (aka Database Manager)
Fixed in
2.7.2
What to do
Update WP-DBManager (aka Database Manager) to 2.7.2 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Oct 21, 2014Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows remote attackers to inCVE-2014-4517 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the searchString parameter.
Product
CBI Referral Manager
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update CBI Referral Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 14, 2014Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to executCVE-2014-4944 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) categoryid or (2) pdfid parameter to wp-admin/admin.php.
Product
BSK PDF Manager
Affected
1.3.2 to 1.3.2
What to do
Affects 1.3.2 to 1.3.2. Update BSK PDF Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in settings/pwsettings.php in the Your Text Manager plugin 0.3.0 and earlier for WordPress allows remote attackers to iCVE-2014-4604 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in settings/pwsettings.php in the Your Text Manager plugin 0.3.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the ytmpw parameter.
Product
Your Text Manager
Affected
up to 0.3.0
What to do
Affects up to 0.3.0. Update Your Text Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in wp-plugins-net/index.php in the WP Plugin Manager (wppm) plugin 1.6.4.b and earlier for WordPress allows remote attaCVE-2014-4593 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-plugins-net/index.php in the WP Plugin Manager (wppm) plugin 1.6.4.b and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
Product
WP Plugin Manager (wppm)
Affected
up to 1.6.4.b
What to do
Affects up to 1.6.4.b. Update WP Plugin Manager (wppm) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in tpls/editmedia.php in the Hot Files: File Sharing and Download Manager (wphotfiles) plugin 1.0.0 and earlier for WorCVE-2014-4588 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in tpls/editmedia.php in the Hot Files: File Sharing and Download Manager (wphotfiles) plugin 1.0.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mediaid parameter.
Product
Hot Files: File Sharing and Download Manager (wphotfiles)
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Hot Files: File Sharing and Download Manager (wphotfiles) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
May 13, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remCVE-2013-1407 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro
Fixed in
5.3.5
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro to 5.3.5 or newer.
Full record and what to do →NVD record archives.neohapsis.com wp-events-plugin.com
May 8, 2014Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated uCVE-2014-3123 · WordPress plugins & themes · reported by MITRELow 2.1
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.
Product
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery
Fixed in
1.19.18
What to do
Update Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery to 1.19.18 or newer.
Full record and what to do →NVD record secunia.com securityfocus.com
Feb 6, 2014Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2013-7319 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title field.
Product
Cross-site scripting (XSS) vulnerability in the Download Manager
Fixed in
2.5.9
What to do
Update Cross-site scripting (XSS) vulnerability in the Download Manager to 2.5.9 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Feb 5, 2014SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute arbitrary SQL commandCVE-2013-1852 · WordPress plugins & themes · reported by Red HatHigh 7.5
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.
Product
SQL injection vulnerability in leaguemanager.php in the LeagueManager
Fixed in
3.8.1
What to do
Update SQL injection vulnerability in leaguemanager.php in the LeagueManager to 3.8.1 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jan 16, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack theCVE-2012-6629 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) conduct script insertion attacks. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Newsletter Manager
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com secunia.com
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web sCVE-2012-6628 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_campName to admin/create_campaign.php or (2) admin/edit_campaign.php, (3) xyz_em_email parameter to admin/edit_email.php, (4) xyz_em_exportbatchSize parameter to import_export.php, or (5) pagination limit in the Newsletter Manager options.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager
Fixed in
1.0.2
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager to 1.0.2 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to injeCVE-2012-6627 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Product
Newsletter Manager
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 8, 2014Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers tCVE-2013-7279 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter.
Product
Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video
Fixed in
0.983
What to do
Update Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video to 0.983 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Sep 30, 2013frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for: Unrestricted file uploadCVE-2013-5962 · WordPress plugins & themes · reported by MITREMedium 5.1
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
Product
frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for
Fixed in
3.3.4
What to do
Update frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for to 3.3.4 or newer.
Full record and what to do →NVD record archives.neohapsis.com codecanyon.net
Jul 19, 2013Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and otCVE-2012-3414 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.
Affected
up to 2.2.0.1
Fixed in
3.3.2
What to do
Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD record bot24.blogspot.ca code.google.com
Apr 19, 2013Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication CVE-2013-2697 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager
Fixed in
1.61
What to do
Update Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager to 1.61 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 21, 2012Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML CVE-2012-2912 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter in the show-league page or (2) season parameter in the team page to wp-admin/admin.php.
Product
LeagueManager
What to do
Update LeagueManager to the newest version.
Full record and what to do →NVD record packetstormsecurity.org securityfocus.com
Apr 21, 2012Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earCVE-2012-2399 · WordPress plugins & themes · reported by MITREHigh 10
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.
Affected
up to 2.2.0.1
Fixed in
3.5.2
What to do
Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD record core.trac.wordpress.org jvn.jp
Jul 30, 2008upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for: Unrestricted file uploadCVE-2008-3362 · WordPress plugins & themes · reported by MITREHigh 10
Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct request to the file in wp-content/plugins/downloads-manager/upload/.
Product
upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for
What to do
Update upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for to the newest version.
Full record and what to do →NVD record securityreason.com securityfocus.com
Jan 10, 2008ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for: Unrestricted file uploadCVE-2008-0222 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.
Product
ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for
What to do
Update ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for to the newest version.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Jul 20, 2007index.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2007-3939 · WordPress plugins & themes · reported by MITREMedium 6.8
SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter.
Product
index.php in SpoonLabs Vivvo Article Management CMS
Affected
up to 3.4
What to do
Affects up to 3.4. Update index.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org securityfocus.com
Jan 30, 2007rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2007-0574 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.40 allows remote attackers to execute arbitrary SQL commands via the wcHeadlines parameter, a different vector than CVE-2006-4715. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Product
rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS
What to do
Update rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS to the newest version.
Full record and what to do →NVD record osvdb.org securityfocus.com
Sep 12, 2006pdf_version.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2006-4715 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in pdf_version.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
pdf_version.php in SpoonLabs Vivvo Article Management CMS
Affected
up to 3.2
What to do
Affects up to 3.2. Update pdf_version.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com securitydot.net
Sep 12, 2006index.php in SpoonLabs Vivvo Article Management CMS: PHP remote file inclusionCVE-2006-4714 · WordPress plugins & themes · reported by MITREMedium 5.1
PHP remote file inclusion vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the classified_path parameter.
Product
index.php in SpoonLabs Vivvo Article Management CMS
Affected
up to 3.2
What to do
Affects up to 3.2. Update index.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com securitydot.net
Nov 26, 2005phpWordPress PHP News and Article Manager 3.0: SQL injectionCVE-2005-3844 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in phpWordPress PHP News and Article Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the (1) poll and (2) category parameters to index.php, and (3) the ctg parameter in an archive action.
Product
phpWordPress PHP News and Article Manager 3.0
What to do
Update phpWordPress PHP News and Article Manager 3.0 to the newest version.
Full record and what to do →NVD record forum.word-press.net pridels0.blogspot.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.